Electronic Data Records Law | How to Win E-Discovery

SANS Conference on Computer Records Policy

Summit Title: "E-Data Retention, Discovery and Destruction: Developing and Implementing IT Policy"

Announcement:  We have cancelled this conference.  We are evaluating whether to revive it at different place, time and/or format.  If readers or potential partners/sponsors have any ideas, please contact Ben Wright.  Many thanks to the speakers who agreed to support this summit.

Former date and place:  September 27-28, 2010, Las Vegas

Summit Description:  Almost unheard of ten years ago, electronic discovery is today chewing up IT resources – equipment, services and staff time.  Recognizing that many electronic records such as e-mail, spreadsheets and text messages might some day be demanded in a lawsuit or freedom-of-information request, what policy should your enterprise adopt for retaining and destroying electronic records?  Although it is foolhardy to keep everything forever, numerous, recent court cases have punished organizations for failing to retain data, or for failing to find and disclose it in a timely, responsive manner.  This summit [conference] draws from the wisdom of diverse experts and end-users, including case studies, to address: 

- the process for setting workable policy,

- techniques for managing storage and service costs,

- confidentiality, security and other tradeoffs between in-house and cloud storage,

- ever-improving methods for searching and culling vast troves of records,

- real-world experiences on the interplay between lawyers and IT professionals,

- protocol for access to records for internal investigations,

- international issues, including non-US privacy laws.

Given that law and technology are simultaneously undergoing rapid change, the summit assesses what the future may hold for e-records management policy, products, services and legal expectations.

We are looking for sponsors and suggestions!  If you wish to exhibit or offer an idea, then please: 

- leave a comment below; or

- call me at 1.214.403.6642; or

- email ben underscore wright at compuserve dot com (put "BLOG" in subject line).

Update:  We are proud to announce these confirmed speakers: 

- Steven Broberg and Shawn Malone of the Records Management Department of Travis County, in Austin, Texas

- Jorge Rey, Director of Information Security and Compliance, Kaufman, Rossin & Co., P.A. (policy development case study)

- Kevin Bong, Director of Corporate Security, Johnson Financial Group (end-user policy case study)

- Sonian, Inc. (cloud email archiving)

- Alex Blumrosen (American attorney practicing in Paris, France)

- Greg Smith, Messaging Architects

- Vivien Osamiluyi, Internal Auditor, Legg Mason

- CrowdFlower will demonstrate crowdsourcing as a tool for assessing large quantities of documents in an official investigation, such as a lawsuit or government inquiry

- Michael Osterman of Osterman Research

- Brian W. Foster, Access Sciences Corporation

- Kevin Larson - Qualcomm, Inc (end user enterprise)

- Digital Reef

- Jesse Wilkins - Access Sciences Corporation

- Jim Balter - University of Miami

Twitter hashtag for the Summit:  #sanspolicy

Summit Agenda

[Tentative as of July 21, 2010 - Subject to Revision.]

[Not yet approved by Speakers.]

September 27 – 28, 2010

Las Vegas, NV

Title: "E-Data Retention, Discovery and Destruction: Developing and Implementing IT Policy"

The mission of this Summit is to stimulate discussion and debate as a tool for learning. Each session will allow ample time for interaction among participants.

DAY ONE Monday, September 27

9:00-9:40: Welcome and Introduction

Speaker: Benjamin Wright, Summit Chairman

 

 

Title: Resolving the conflict in electronic records retention policy setting.

Abstract: The quantities of electronic records are skyrocketing, and courts are expecting better retention of them. How do we reconcile these developments with traditional records management practices? What to expect in this Summit. Mr. Wright will query participants to bring their issues and experiences to light.

Throughout the Summit, Mr. Wright will attempt to summarize and stimulate discussion around major points that emerge from the sessions.

9:50 – 10:50

Title: Records Managers – Travis County, Texas – Confront E-mail

Speakers: Steven Broberg and Shawn Malone, Records Department, Travis County, Texas.

 

 

Abstract:  Professional records managers will articulate the considerable challenges they have encountered in trying to square legal expectations with the realities of email in a complex enterprise having 4500 email users.

10:50 – 11:10 Break

11:10 - 12:15

Session Title: Experts on Record Retention Policies

Speaker: Access Sciences Corporation - Brian W. Foster (former Director of eDiscovery at one of the top five global oil companies) and Jesse Wilkins

Session description to be determined.

Lunch 12:15 – 1:30

1:30 – 2:20

Session Title: Finding Email Records in the Real World

Speaker: Greg Smith, Messaging Architects

Abstract: Practical e-discovery experience – the proliferation of email records throughout an enterprise, including in unexpected places. Stories from the trenches.

 

 

2:20 – 2:40 Break

2:40 – 3:55

Session Title: User Panel

Abstract: All enterprises wrestle with how to set policy for the retention of electronic records in a changing environment. Hearing the experiences of diverse user enterprises can paint a more realistic picture of what is possible and what should be expected for well-crafted policy.

Panel Members:

Internal Auditor: Vivien Osamiluyi, Legg Mason

Kevin Bong - Johnson Financial Group

 

Kevin Larson - Qualcomm, Inc (end user enterprise) - How do security issues influence policy on electronic records retention? Podcast about Kevin's presentation: Download Sans_intro_klarson

- Jim Balter - University of Miami

 

Steven Broberg and Shawn Malone, Records Department, Travis County, Texas

4:00 – 5:00

Session Title: e-Discovery's Influence on Email Record Retention Policy

Speakers: Digital Reef - Steve Akers (Founder and CTO) and Digital Reef's Customer, James Bandes

Abstract: What are practical experiences with e-discovery telling us about how to write and implement e-record retention policies?

DAY TWO Tuesday, September 28

9:00 – 10:00

Session Title: European Experience

Speaker: Attorney Alexander Blumrosen, Bernard-Hertz-Béjot - Paris, France

Abstract: In lawsuits and investigations, privacy issues can loom larger outside the US. How are these issues influencing e-Discovery and the development of e-records policy in Europe?

10:05 – 11:00

Session Title: Drawing Practical Lessons

Speaker: Benjamin Wright, Summit Chairman

Abstract: What are the larger implications of the stories from day 1? How can these be combined with the lessons today to write a take-home list of principles and guidelines? Mr. Wright will lead the group in compiling that list, starting now and running through the rest of the day.

11:00 – 11:20 Break

11:20 – 12:15

Session Title: The Future of Electronic Records Policy and Technology

Speaker: Michael Osterman, Osterman Research

Abstract: What are the big trends in records management and e-discovery and how are organizations not keeping pace from a policy perspective with regard to records management, social media management, or managing data for regulatory or legal compliance? How is technology changing and what is the role of technology vis-à-vis things like employee training and establishment of corporate policies? What can we expect two years, five years from now? How should enterprises prepare for the future from both a technology and non-technology perspective?

12:15 – 1:30 Lunch

1:30 - 2:30

Session Title:  e-Mail & Electronic Records Disposal Policy Case Study

Speaker: Jorge Rey, CISA, Kaufman, Rossin & Co., P.A.

 

Abstract: In this case study, an accounting firm helped an organization save costs by implementing a policy that reduced the quantity of electronic records and emails retained. During this session, ample time will be available for all Summit participants ask questions, make comments and debate.

2:30 – 2:50 Break

2:50 – 3:40

Session Title: Cloud Storage of Records

Speaker: Sonian, Inc. and End-User Customer

Abstract: What are the true costs for storing enterprise email in the cloud? As a practical matter, can the enterprise be assured that those records will be secure and will be retrievable many years in the future? Will privacy and confidentiality issues limit the use of cloud services for the storage of critical business archives? Can these issues be addressed with contracts, technical controls and other procedures?

3:45 - 4:15

Session Title: TBA

Speaker: TBA

4:20 – 5:00

MUST SEE HIGHLIGHT OF THIS SUMMIT!

Session Title: Crowdsourcing Demonstration

Speaker: CrowdFlower

Abstract: In modern lawsuits and investigations, the massive volumes of electronic records is daunting. How do we make sense of all these records? Crowdsourcing may be one effective tool, where a swarm, an army, of virtual workers is employed to review and analyze records. CrowdFlower will present a pioneering demonstration of this concept, live at the Summit. Don't miss this unprecedented learning experience.   Download Media alert SANS-CrowdFlower

 

FRE 502 Electronic Mail | Federal Cases

Inadvertent Disclosure of Privileged Records in E-Discovery

Scrub EDD

A danger in e-discovery is that the party disclosing records will inadvertently give its opponent some that are protected by attorney-client privilege (i.e., attorney-client confidentiality) or as attorney work product.  E-discovery records are often so voluminous that privileged records might be turned over by mistake.

To address the danger Congress is adding Rule 502 to the Federal Rules of Evidence.  Effectively the new Rule provides that if a litigant inadvertently discloses a privileged document, he can still prevent his opponent from using it – so long as he took reasonable steps to prevent the disclosure in the first place. In other words, before releasing records, a litigant needs to make a reasonable search through them to cull out (screen) any that contain protected attorney-client communications (or attorney work product).  

Protection Denied

Such a search is not always easy.  In Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251 (D. Md. 2008), the defendant did search to cull or filter out privileged communications before delivering a mass of e-discovery records to the plaintiff.  But the cull was imperfect, and 165 privileged documents passed to the plaintiff.  

The defendant argued those 165 records should still be protected (i.e., the plaintiff should return them and refrain from using them), but the court disagreed.  The court said for those 165 documents the defendant had “waived” the privilege.  The court justified its decision by criticizing the methods the defendant used to cull out the privileged records, noting that simple keyword searches are known to miss things in electronically stored information (ESI).  The court concluded the defendant’s methods were not reasonable, as the defendant could not document it had designed and executed anything beyond a slapdash, rudimentary keyword search.

When Protection Applies

An explanatory note to new Rule 502 describes a good search:  “Depending on the circumstances, a party that uses advanced analytical software applications and linguistic tools in screening for privilege and work product may be found to have taken ‘reasonable steps’ to prevent inadvertent disclosure.  The implementation of an efficient system of records management before litigation may also be relevant.” --Explanatory Note on Evidence Rule 502 Prepared by the Judicial Conference Advisory Committee on Evidence Rules (Revised 11/28/2007)

Incentive for Searchable Archive

Accordingly, Rule 502 will give enterprises more reason to keep well-indexed e-mail records in an archival system that supports sophisticated searches and makes records about those searches as they are executed.* 

–Benjamin Wright

*Here is another reason for maintaning an email archive:  A competent email archive provides an enterprise a core group of records to search under an eDiscovery demand.  It enables the enterprise to say, in reply to the demand: "I can easily and inexpensively search this core archive.  It is not reasonable to expect me to search more deeply."